StaySuite

Privacy policy

1. Who processes your data

StaySuite is a brand of CODELABS STUDIO, S.L., tax ID (NIF) B88708797, with registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), España, registered in the Commercial Registry of Málaga (Registro Mercantil de Málaga), sheet MA-198508, 1st entry.

For any question about your personal data you can write to hola@staysuite.pro. This policy explains what data is processed on staysuite.pro, in the StaySuite dashboard and in the assistants that StaySuite provides to the businesses that subscribe to it, and in which role CODELABS STUDIO, S.L. acts in each case.

Last updated: 2026-10-31. This is a translation; if there is any discrepancy, the Spanish version prevails.

2. What the service is and does

StaySuite gives owners and managers of holiday and rural accommodation a website with calendar and availability, an artificial intelligence assistant that answers by phone, from the website and by chat in the guest's language, the capture of booking requests that the owner confirms, publication of the calendar through iCal links so that portals such as Airbnb or Booking can read it, and the collection and validation of the guest register.

3. Two different roles: controller and processor

  • As controller, CODELABS STUDIO, S.L. decides on the data of people who visit this website, ask for a demo or a call, write to us, and of the staff of client businesses who use the dashboard.
  • As processor (Article 28 of the General Data Protection Regulation, GDPR), CODELABS STUDIO, S.L. processes on behalf of each client business the data of its guests and people asking about a stay. In that case the controller is the accommodation or its management company, which decides what the data is used for; we only process it to provide the service and following its instructions.

If you are a customer of a business that uses StaySuite, exercise your rights with that business. If you write to us, we will forward your request to it without delay.

4. Data we process as controller

  • Visiting the website: IP address and technical connection data logged by the server, and your choice in the cookie banner. The Meta pixel is only loaded if you accept advertising cookies (see the cookie policy).
  • Call request ("call me now"): the phone number you type, the page language and the result of the Cloudflare Turnstile bot check. Before dialling, the number is checked against the Spanish Robinson opt-out list; if it is listed, we only call once you prove the number is yours with a six-digit code we send you by SMS (Spanish numbers only).
  • Voice demo in the browser: the audio from your microphone while you talk to the demo assistant and the transcript of the conversation. It only starts when you press the button and allow the microphone.
  • Contact by email or WhatsApp: your contact details and whatever you tell us.
  • Dashboard users: name, email and the identifier of your account in the Codelabs sign-in system (auth.codelabs.studio), the business you belong to and your role, and a log of the relevant actions you take in the dashboard.
  • Client business data for contracting and invoicing: company name, tax ID, address, contact phone and email, plan and subscription status.

Demo calls and conversations with our assistants are also recorded and transcribed, and the assistant says so at the start.

5. Data we process on behalf of the client business

  • Conversations: audio recording of each call, its transcript, the summary and score shown in the dashboard, and chat messages.
  • Booking requests: check-in and check-out dates, number of guests, name, phone, email and notes. The assistant cannot confirm a booking: all it records is a pending request that the owner accepts or declines from the dashboard.
  • Bookings: booking reference, dates, number of adults and children, price breakdown, channel the booking came from, and the guest's name, phone, email and language.
  • Guest register (Spanish Royal Decree 933/2021): first name and surnames, type and number of identity document, support number of the Spanish DNI, nationality, date of birth, sex, relationship in the case of minors, address, phone and email of each guest.
  • Saved searches: dates, number of guests and contact details of people who ask to be told when something suitable becomes available.

6. Call recording

Every call answered by the StaySuite voice assistant is recorded and transcribed. At the start of each call the assistant says that it is an artificial intelligence and that the call is recorded.

The client business can listen to every call in full in its dashboard, with the transcript moving along with the audio. The recording lets the business check what each customer was told, follow up properly on what was asked and resolve any disagreement, for example about a viewing, a booking or a price.

The audio is served to the dashboard through signed links that expire after a few minutes: anyone without access to that dashboard cannot listen to it.

Guest register: StaySuite gives the holder one link per booking with a form where the guest fills in their details (stored encrypted), and validates the format of each document (for example the check letter of the Spanish DNI and NIE), but it does not send them to the Spanish Ministry of the Interior. The accommodation holder exports them and files them on SES.Hospedajes, and that filing is their own legal obligation as controller. If the activity is not professional, the data is deleted when the report is marked as sent or, at the latest, 30 days after departure; if it is professional, it is kept for three years.

7. Purposes and legal bases

  • Handling your request for a demo, a call or information: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
  • Providing the contracted service, managing the account and giving support: performance of the contract (Article 6(1)(b) GDPR).
  • Invoicing and meeting accounting and tax obligations: legal obligation (Article 6(1)(c) GDPR).
  • Checking the Robinson list before calling: legal obligation under Spanish Law 11/2022 on Telecommunications and data protection law (Article 6(1)(c) GDPR).
  • Recording demo calls and conversations, protecting the website against abuse and bots, and keeping the server's technical logs: legitimate interest in the security of the service and in being able to review what the assistant said (Article 6(1)(f) GDPR).
  • Measuring advertising with the Meta pixel: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from the cookie settings button in the footer.
  • Data we process on behalf of the business: the legal basis is determined by the accommodation or its management company as controller. Usually it is handling its customer's own request, consent for saved searches and alerts and, where applicable, a legal obligation.
  • Analysing how the service is used, and the personal emails we send after sign-up: legitimate interest (Article 6(1)(f) GDPR). You can object by writing to hola@staysuite.pro or replying to any of those emails, with no need to give reasons and without losing the service.
  • Heatmaps and session recording in the panel: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from your account.

How we analyse the use of StaySuite. We want to understand what fails and what we do not explain well. To do so we look at how the panel is used, the questions put to the sales assistant on this website, voice conversations with that assistant (always after a notice) and the opinions you send us. The data of your business's customers and their conversations with its assistant are not part of this analysis: from them we only use activity figures (for example, how many searches, contacts or viewings your business has), never their content. Our team sees those figures in its internal report on each user, together with your identity and your billing. If we need to look at content to give you support or resolve an incident, we do so as processor, on behalf of your business.

Heatmaps and session recording: only in the panel, only with your consent in the cookie banner, with PostHog (hosted in the European Union) and with all text and fields masked. The public websites of client businesses do not load them.

No automated decisions: this analysis does not change your price, your plan or your access, and has no legal effects on you.

Controller: Codelabs Studio, S.L., PASAJE Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain.

8. Artificial intelligence

StaySuite assistants introduce themselves as artificial intelligence at the start of every conversation, as required by Regulation (EU) 2024/1689 on artificial intelligence.

To understand speech, converse and speak, the assistants use language and voice models from the providers listed below. The score of each conversation shown in the dashboard is indicative, to help the business decide whom to attend to first: neither the assistant nor the platform takes decisions with legal effects on anyone.

9. Who the data is shared with

We do not sell personal data or disclose it to third parties for their own purposes. To provide the service we use these providers, under data processing agreements:

  • AgenteUno, the voice and messaging platform of CODELABS STUDIO, S.L. itself (not a third party): it handles calls, chat, recordings and transcripts.
  • Hetzner Online GmbH (Germany): servers for the application, the database and email.
  • Cloudflare, Inc.: DNS, bot check (Turnstile) and storage of recordings.
  • Telnyx and Twilio: telephony for the voice platform.
  • Cerebras Systems Inc. (United States): language model that processes the assistant's chat messages.
  • Google LLC (Gemini Live, United States): voice model that processes the audio and transcript of voice conversations.
  • Meta Platforms: WhatsApp messages, when the business uses that channel, and the advertising pixel on this website, only with your consent.
  • Google LLC: Google Calendar, only if the business connects its calendar. Permissions are limited to creating and deleting viewings and to checking whether a time is free or busy, without reading the content of other events.
  • OpenStreetMap Foundation (United Kingdom): the map on property or accommodation pages, which receives the IP address of whoever views it.
  • PostHog, Inc. (hosted in the European Union): analysis of the use of the panel and session recording, only with your consent.

We will also disclose data to the authorities when the law requires us to.

10. International transfers

The main servers are in the European Union. Some of the providers above are based in the United States and may process data outside the European Economic Area. In that case the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). The United Kingdom benefits from an adequacy decision of the European Commission.

Language model providers and international transfers. The conversational assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as a processor. In voice conversations, the audio and its transcript are processed by Google LLC (Gemini Live, United States). Google LLC is certified under the EU-US Data Privacy Framework (DPF), so that transfer relies on the European Commission's adequacy decision, and its processor terms also incorporate the standard contractual clauses. Cerebras Systems Inc. is not on the DPF list: the transfer to this provider relies on the standard contractual clauses (Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA).

In the sample demonstration agencies, the assistant's chat uses Gemini, from Google LLC, with the same safeguards.

11. How long data is kept

  • Requests for a demo, a call or information: as long as needed to handle them; afterwards, blocked for the limitation periods of any claims that might arise.
  • Client account and business data: for the term of the contract and then for the periods required by commercial and tax law.
  • Saved searches: 180 days from when they are saved, unless the business sets a different period or the person unsubscribes earlier.
  • Recordings, transcripts and other data of the business's customers: while the business keeps the service and according to its instructions. When the contract ends they are deleted or returned to the business, unless a law requires them to be kept.
  • Cookies: the period stated in the cookie policy.
  • Your user account: you can delete it from “Your account” in the panel. Your name and email are erased at that moment and your reason for leaving is kept without them. That does not delete the data of the business's customers, which depends on the business as controller.

12. Your rights

You can request access to your data, its rectification or erasure, restriction of processing and portability, object to processing, and withdraw at any time any consent you have given, by writing to hola@staysuite.pro. If we need to verify your identity we will ask you. We reply within one month.

If you believe we have not handled your request properly, you can complain to the supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

13. Security

Communications are encrypted. Each business only accesses its own data, and each dashboard user according to their role. Credentials of connected calendars are stored encrypted and recordings are served through short-lived signed links.

14. Minors and changes to this policy

StaySuite is a service for businesses and is not aimed at minors.

If we change this policy in a meaningful way, we will show it on this page with the new date and tell client businesses by email.

hola@staysuite.pro